diff --git a/docs/content/usage/reports/mitre.md b/docs/content/usage/reports/mitre.md index 994bc189b..05f87ba03 100644 --- a/docs/content/usage/reports/mitre.md +++ b/docs/content/usage/reports/mitre.md @@ -4,6 +4,10 @@ date: 2020-06-24T21:17:18+03:00 draft: false --- +{{% notice info %}} +Check out [the documentation for the other reports as well](../). +{{% /notice %}} + The Monkey maps its actions to the [MITRE ATT&CK](https://attack.mitre.org/) knowledge base: It provides a new report with the utilized techniques and recommended mitigations, to help you simulate an APT attack on your network and mitigate real attack paths intelligently. Watch an overview video: diff --git a/docs/content/usage/reports/security.files/infection_monkey_security_report_example.pdf b/docs/content/usage/reports/security.files/infection_monkey_security_report_example.pdf new file mode 100644 index 000000000..ed25290d4 Binary files /dev/null and b/docs/content/usage/reports/security.files/infection_monkey_security_report_example.pdf differ diff --git a/docs/content/usage/reports/security.md b/docs/content/usage/reports/security.md index 082ec32eb..a36106183 100644 --- a/docs/content/usage/reports/security.md +++ b/docs/content/usage/reports/security.md @@ -4,22 +4,94 @@ date: 2020-06-24T21:16:10+03:00 draft: false --- -The report is split into 3 categories: +{{% notice info %}} +Check out [the documentation for the other reports as well](../). +{{% /notice %}} + +The Monkey's Security Report is built to provide you with actionable recommendations and insight to the Attacker's view of your network. You can download a PDF of this example report: + +{{%attachments title="Download the PDF" pattern=".*(pdf)"/%}} + +The report is split into 3 main categories: "Overview", "Recommendations" and "The network from the Monkey's eyes". + +- [Overview](#overview) + - [High level information](#high-level-information) + - [Used Credentials](#used-credentials) + - [Exploits and targets](#exploits-and-targets) + - [Security Findings](#security-findings) +- [Recommendations](#recommendations) + - [Machine related recommendations relating to specific CVEs](#machine-related-recommendations-relating-to-specific-cves) + - [Machine related recommendations relating to network security and segmentation](#machine-related-recommendations-relating-to-network-security-and-segmentation) +- [The network from the Monkey's eyes](#the-network-from-the-monkeys-eyes) + - [Network infection map](#network-infection-map) + - [Scanned servers](#scanned-servers) + - [Exploits and post-breach actions](#exploits-and-post-breach-actions) + - [Stolen Credentials](#stolen-credentials) ## Overview The overview section of the report provides high-level information about the Monkey execution and the main security findings that the Monkey has found. -- [ ] TODO add screenshot +### High level information + +The report starts with information about the execution, including how long the simulation took and from which machine the infection started from. + +![Overview](/images/usage/reports/sec_report_1_overview.png "Overview") + +### Used Credentials + +The report will show which credentials were used for brute-forcing. + +![Used Credentials](/images/usage/reports/sec_report_2_users_passwords.png "Used Credentials") + +### Exploits and targets + +The report shows which exploits were attempted in this simulation and which targets the Monkey scanned and tried to exploit. + +![Exploits and Targets](/images/usage/reports/sec_report_3_exploits_ips.png "Exploits and Targets") + +### Security Findings + +The report highlights the most important security threats and issues the Monkey discovered during the attack. + +![Threats and issues](/images/usage/reports/sec_report_4_threats_and_issues.png "Threats and issues") ## Recommendations This section contains the Monkey's recommendations for improving your security - what mitigations you need to implement. -- [ ] TODO add screenshot +### Machine related recommendations relating to specific CVEs + +![Machine related recommendations](/images/usage/reports/sec_report_5_machine_related.png "Machine related recommendations") + +### Machine related recommendations relating to network security and segmentation + +![Machine related recommendations](/images/usage/reports/sec_report_6_machine_related_network.png "Machine related recommendations") ## The network from the Monkey's eyes This section contains the Infection Map and some summary tables on servers the Monkey has found. -- [ ] TODO add screenshot +### Network infection map + +This part shows the network map and a breakdown of how many machines were breached. + +![Network map](/images/usage/reports/sec_report_7_network_map.png "Network map") + +### Scanned servers + +This part shows the attack surface the Monkey has found. + +![Scanned servers](/images/usage/reports/sec_report_8_network_services.png "Scanned servers") + +### Exploits and post-breach actions + +This part shows which exploits and Post Breach Actions the Monkey has performed in this simulation. + +![Exploits and PBAs](/images/usage/reports/sec_report_9_exploits_pbas.png "Exploits and PBAs") + +### Stolen Credentials + +This part shows which credentials the Monkey was able to steal from breached machines in this simulation. + +![Stolen creds](/images/usage/reports/sec_report_10_stolen_credentials.png "Stolen creds") diff --git a/docs/content/usage/reports/zero-trust.md b/docs/content/usage/reports/zero-trust.md index d920e2745..8d6c55aaa 100644 --- a/docs/content/usage/reports/zero-trust.md +++ b/docs/content/usage/reports/zero-trust.md @@ -4,6 +4,10 @@ date: 2020-06-24T21:16:18+03:00 draft: false --- +{{% notice info %}} +Check out [the documentation for the other reports as well](../). +{{% /notice %}} + The Guardicore Infection Monkey runs different tests to evaluate your network adherence to key components of the Zero Trust framework as established by Forrester, such as whether you have applied segmentation, user identity, encryption and more. Then, the Monkey generates a status report with detailed explanations of security gaps and prescriptive instructions on how to rectify them. ## Summary diff --git a/docs/content/usage/scenarios.md b/docs/content/usage/scenarios.md index cb65816de..20cab0d27 100644 --- a/docs/content/usage/scenarios.md +++ b/docs/content/usage/scenarios.md @@ -1,9 +1,10 @@ --- title: "Scenarios" date: 2020-05-26T21:01:19+03:00 -draft: true +draft: false weight: 2 tags: ["usage"] +pre: " " --- In this page we show how you can use the Infection Monkey to simulate breach and attack scenarios as well as to share some cool tips and tricks you can use to up your Infection Monkey game. This page is aimed at both novice and experienced Monkey users. You can also refer to [our FAQ](../../faq) for more specific questions and answers. @@ -52,6 +53,8 @@ To simulate the damage from a successful phishing attack using the Infection Mon - You can configure these credentials for the Monkey as follows: From the **“Basic - Credentials”** tab of the Island’s configuration, under the **“Exploit password list”** press the ‘+’ button and add the passwords you would like the Monkey to use. Do the same with usernames in the **“Exploit user list”**. +![Exploit password and user lists](/images/usage/scenarios/user-password-lists.png "Exploit password and user lists") + After supplying the Monkey with the passwords and usernames, execute the Monkey from the simulated “victim” machines. To do this, click “**2. Run Monkey**” from the left sidebar menu and choose “**Run on machine of your choice**”. ## You want to test your network segmentation diff --git a/docs/static/images/usage/reports/sec_report_10_stolen_credentials.png b/docs/static/images/usage/reports/sec_report_10_stolen_credentials.png new file mode 100644 index 000000000..f4bcd4a32 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_10_stolen_credentials.png differ diff --git a/docs/static/images/usage/reports/sec_report_1_overview.png b/docs/static/images/usage/reports/sec_report_1_overview.png new file mode 100644 index 000000000..28d7d4df1 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_1_overview.png differ diff --git a/docs/static/images/usage/reports/sec_report_2_users_passwords.png b/docs/static/images/usage/reports/sec_report_2_users_passwords.png new file mode 100644 index 000000000..32c967785 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_2_users_passwords.png differ diff --git a/docs/static/images/usage/reports/sec_report_3_exploits_ips.png b/docs/static/images/usage/reports/sec_report_3_exploits_ips.png new file mode 100644 index 000000000..2879b4812 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_3_exploits_ips.png differ diff --git a/docs/static/images/usage/reports/sec_report_4_threats_and_issues.png b/docs/static/images/usage/reports/sec_report_4_threats_and_issues.png new file mode 100644 index 000000000..09066d5a1 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_4_threats_and_issues.png differ diff --git a/docs/static/images/usage/reports/sec_report_5_machine_related.png b/docs/static/images/usage/reports/sec_report_5_machine_related.png new file mode 100644 index 000000000..cd0048376 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_5_machine_related.png differ diff --git a/docs/static/images/usage/reports/sec_report_6_machine_related_network.png b/docs/static/images/usage/reports/sec_report_6_machine_related_network.png new file mode 100644 index 000000000..199715503 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_6_machine_related_network.png differ diff --git a/docs/static/images/usage/reports/sec_report_7_network_map.png b/docs/static/images/usage/reports/sec_report_7_network_map.png new file mode 100644 index 000000000..9f5bdf8dd Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_7_network_map.png differ diff --git a/docs/static/images/usage/reports/sec_report_8_network_services.png b/docs/static/images/usage/reports/sec_report_8_network_services.png new file mode 100644 index 000000000..9f8eb6049 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_8_network_services.png differ diff --git a/docs/static/images/usage/reports/sec_report_9_exploits_pbas.png b/docs/static/images/usage/reports/sec_report_9_exploits_pbas.png new file mode 100644 index 000000000..c4b3d7064 Binary files /dev/null and b/docs/static/images/usage/reports/sec_report_9_exploits_pbas.png differ